https://community.splunk.com/t5/Splunk-Search/How-to-chart-URLS-by-error-code-percentage/m-p/179198#M51575 <P>Is there a solution here? This will not get percentage of 408 errors over total requests.<BR /> Thanks,</P> Thu, 20 Aug 2015 22:20:56 GMT Fergal111 2015-08-20T22:20:56Z https://community.splunk.com/t5/Splunk-Search/How-to-chart-URLS-by-error-code-percentage/m-p/179194#M51571 <P>We are grabbing logs from nginx. I would like to know how I can chart URLS that are returning a 408 error code as well as a percentage from the overall status codes. Here is an example of what I am trying to do:</P> <P>Build a chart that shows all the PUTs and POSTs requests followed by the URL, then show the percentage of the error code out of all percentage codes in the log.</P> <PRE><CODE>"PUT /borrower/api/v1/prospect/update HTTP/1.1" 408 0 "POST /borrower/api/v1/registration HTTP/1.1" 408 51 </CODE></PRE> Mon, 17 Aug 2015 20:40:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-chart-URLS-by-error-code-percentage/m-p/179194#M51571 mgpspr 2015-08-17T20:40:35Z https://community.splunk.com/t5/Splunk-Search/How-to-chart-URLS-by-error-code-percentage/m-p/179195#M51572 <P>First, check the <A href="http://answers.splunk.com/answers/44587/nginx-log-parsing.html">nginx log parsing</A> post on Answers for parsing your logs.</P> <P>Then if you name your fields "path" and "code" you simply do something like:</P> <PRE><CODE>... | top code limit=0 | table code, percentage | where code=408 </CODE></PRE> <P>To give you a breakdown of the percentage of codes without the default 10 items to list all options in case there are more than 10 and your 408 code is low on the list, then pull out the code and percentage only as a table, limited to only entries with the 408 code.</P> <P>There are a number of other ways to slice this up, as well, but this ought to get you want you need.</P> Mon, 17 Aug 2015 21:03:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-chart-URLS-by-error-code-percentage/m-p/179195#M51572 jtrucks 2015-08-17T21:03:05Z https://community.splunk.com/t5/Splunk-Search/How-to-chart-URLS-by-error-code-percentage/m-p/179196#M51573 <P>Though if you're only concerned with status=408, I'd go ahead and put it in the originating search, before the "|top" shown here.</P> Mon, 17 Aug 2015 21:05:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-chart-URLS-by-error-code-percentage/m-p/179196#M51573 mikelanghorst 2015-08-17T21:05:39Z https://community.splunk.com/t5/Splunk-Search/How-to-chart-URLS-by-error-code-percentage/m-p/179197#M51574 <P>mikelanghorst, that prevents you from getting the % 408 codes of the whole.</P> Tue, 18 Aug 2015 00:57:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-chart-URLS-by-error-code-percentage/m-p/179197#M51574 jtrucks 2015-08-18T00:57:21Z https://community.splunk.com/t5/Splunk-Search/How-to-chart-URLS-by-error-code-percentage/m-p/179198#M51575 <P>Is there a solution here? This will not get percentage of 408 errors over total requests.<BR /> Thanks,</P> Thu, 20 Aug 2015 22:20:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-chart-URLS-by-error-code-percentage/m-p/179198#M51575 Fergal111 2015-08-20T22:20:56Z https://community.splunk.com/t5/Splunk-Search/How-to-chart-URLS-by-error-code-percentage/m-p/179199#M51576 <P>@fergal111 do something like</P> <PRE><CODE>... | top url by status </CODE></PRE> <P>^ there are any number of similar solutions</P> Thu, 20 Aug 2015 22:58:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-chart-URLS-by-error-code-percentage/m-p/179199#M51576 aljohnson_splun 2015-08-20T22:58:11Z